CVE-2015-3886 Information

Description

libinfinity before 0.6.6-1 does not validate expired SSL certificates which allows remote attackers to have unspecified impact via unknown vectors.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

http://seclists.org/oss-sec/2015/q2/410 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783601 https://bugzilla.redhat.com/show_bug.cgi?id=1221266 https://github.com/gobby/gobby/issues/61 https://github.com/gobby/libinfinity/commit/c97f870f5ae13112988d9f8ad464b4f679903706

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8